CVE-2026-115355
published 2026-10-22CVE-2026-115355: Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.46%
39.8th percentile
Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| lepture | mistune | < 3.3.0 | 3.3.0 |
| mistune_project | mistune | >= 0 < 3.3.0 | 3.3.0 |
| rhoai | odh-feature-server-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-minimal-cpu-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-rocm-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 | — | — |
| rhoai | odh-th-torch-cpu-py312-rhel9 | — | — |
| rhoai | odh-th-torch-cuda-py312-rhel9 | — | — |
| rhoai | odh-th-torch-rocm-py312-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-rocm64-torch291-py312-rhel9 | — | — |
| rhoai | odh-workbench-codeserver-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Mistune: Path Traversal and XSS in Include directive
ghsa·2026-10-23
CVE-2026-115355 [HIGH] CWE-22 Mistune: Path Traversal and XSS in Include directive
Mistune: Path Traversal and XSS in Include directive
The Include directive in `src/mistune/directives/include.py` does not validate that the resolved file path stays within the source directory, allowing path traversal via `../` sequences to read arbitrary files.
Additionally, error messages and included file contents are rendered without HTML escaping, leading to XSS even when `escape=True`.
Affected functions:
- Path resolution (lines 27-31)
- `block_error()` in html.py (line 140)
- `render_html_include()` (line 72)
The Include plugin must be explicitly enabled via the plugins parameter.
GHSA
Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths.
ghsa_unreviewed·2026-10-22
CVE-2026-115355 [HIGH] CWE-22 Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths.
Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.
Red Hat
mistune: mistune: Arbitrary file read via path traversal in Include directive
vendor_redhat·2026-10-22·CVSS 7.5
CVE-2026-115355 [HIGH] CWE-22 mistune: mistune: Arbitrary file read via path traversal in Include directive
mistune: mistune: Arbitrary file read via path traversal in Include directive
Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.
A flaw was found in Mistune. A remote attacker can exploit a path traversal vulnerability in the Include directive by supplying manipulated file paths to access and read arbitrary files on the system. Furthermore, an attacker can inject malicious content through unescaped error messages and included files, potentially leading to cross-site scripting (XSS).
Statement: This vulnerability
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-115355 python-mistune: mistune: Arbitrary file read via path traversal in Include directive [fedora-44]
bugzilla·2026-10-23·CVSS 7.5
CVE-2026-115355 [HIGH] CVE-2026-115355 python-mistune: mistune: Arbitrary file read via path traversal in Include directive [fedora-44]
CVE-2026-115355 python-mistune: mistune: Arbitrary file read via path traversal in Include directive [fedora-44]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.
Bugzilla
CVE-2026-115355 python-mistune: mistune: Arbitrary file read via path traversal in Include directive [epel-9]
bugzilla·2026-10-23·CVSS 7.5
CVE-2026-115355 [HIGH] CVE-2026-115355 python-mistune: mistune: Arbitrary file read via path traversal in Include directive [epel-9]
CVE-2026-115355 python-mistune: mistune: Arbitrary file read via path traversal in Include directive [epel-9]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.
Bugzilla
CVE-2026-115355 python-mistune: mistune: Arbitrary file read via path traversal in Include directive [epel-8]
bugzilla·2026-10-23·CVSS 7.5
CVE-2026-115355 [HIGH] CVE-2026-115355 python-mistune: mistune: Arbitrary file read via path traversal in Include directive [epel-8]
CVE-2026-115355 python-mistune: mistune: Arbitrary file read via path traversal in Include directive [epel-8]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.
Bugzilla
CVE-2026-115355 python-mistune: mistune: Arbitrary file read via path traversal in Include directive [epel-10]
bugzilla·2026-10-23·CVSS 7.5
CVE-2026-115355 [HIGH] CVE-2026-115355 python-mistune: mistune: Arbitrary file read via path traversal in Include directive [epel-10]
CVE-2026-115355 python-mistune: mistune: Arbitrary file read via path traversal in Include directive [epel-10]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.
Bugzilla
CVE-2026-115355 python-mistune08: mistune: Arbitrary file read via path traversal in Include directive [epel-9]
bugzilla·2026-10-23·CVSS 7.5
CVE-2026-115355 [HIGH] CVE-2026-115355 python-mistune08: mistune: Arbitrary file read via path traversal in Include directive [epel-9]
CVE-2026-115355 python-mistune08: mistune: Arbitrary file read via path traversal in Include directive [epel-9]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.
Bugzilla
CVE-2026-115355 python-mistune: mistune: Arbitrary file read via path traversal in Include directive [fedora-rawhide]
bugzilla·2026-10-23·CVSS 7.5
CVE-2026-115355 [HIGH] CVE-2026-115355 python-mistune: mistune: Arbitrary file read via path traversal in Include directive [fedora-rawhide]
CVE-2026-115355 python-mistune: mistune: Arbitrary file read via path traversal in Include directive [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.
Bugzilla
CVE-2026-115355 python-mistune: mistune: Arbitrary file read via path traversal in Include directive [fedora-43]
bugzilla·2026-10-23·CVSS 7.5
CVE-2026-115355 [HIGH] CVE-2026-115355 python-mistune: mistune: Arbitrary file read via path traversal in Include directive [fedora-43]
CVE-2026-115355 python-mistune: mistune: Arbitrary file read via path traversal in Include directive [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.
Bugzilla
CVE-2026-115355 mistune: mistune: Arbitrary file read via path traversal in Include directive
bugzilla·2026-10-22·CVSS 7.5
CVE-2026-115355 [HIGH] CVE-2026-115355 mistune: mistune: Arbitrary file read via path traversal in Include directive
CVE-2026-115355 mistune: mistune: Arbitrary file read via path traversal in Include directive
Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.
2026-10-22
Published